@holin-work/holin-cli 1.3.6 → 1.3.8

package/bin/holin-cli.js

@@ -34,6 +34,7 @@ const CONFIG_DIR = join(
 const CREDENTIALS_FILE = join(CONFIG_DIR, "credentials.json");
 const PID_FILE = join(CONFIG_DIR, "proxy.pid");
 const LOG_FILE = join(CONFIG_DIR, "proxy.log");
+const LOGIN_LOCK_FILE = join(CONFIG_DIR, "login.lock"); // written by auth login, read by proxy healthcheck
 
 // ── Helpers ──────────────────────────────────────────────────────────────────
 
@@ -234,6 +235,25 @@ function createProxyServer() {
         return;
       }
 
+      // Health check endpoint — must be before credential check so waitForPort probes always succeed
+      if (req.method === "GET" && req.url === "/health") {
+        const creds = readCredentials();
+        const body = JSON.stringify({
+          status: "ok",
+          authenticated: !!(creds?.api_key),
+          customer: creds?.customer_name || null,
+          plan: creds?.plan || null,
+          upstream: UPSTREAM_URL,
+          pid: process.pid,
+        });
+        res.writeHead(200, {
+          "Content-Type": "application/json",
+          "Content-Length": Buffer.byteLength(body),
+        });
+        res.end(body);
+        return;
+      }
+
       // Read credentials on every request (hot-reload support)
       const creds = readCredentials();
       if (!creds?.api_key) {
@@ -248,24 +268,6 @@ function createProxyServer() {
       return;
     }
 
-    // Health check endpoint
-    if (req.method === "GET" && req.url === "/health") {
-      const body = JSON.stringify({
-        status: "ok",
-        authenticated: !!(creds && creds.api_key),
-        customer: creds?.customer_name || null,
-        plan: creds?.plan || null,
-        upstream: UPSTREAM_URL,
-        pid: process.pid,
-      });
-      res.writeHead(200, {
-        "Content-Type": "application/json",
-        "Content-Length": Buffer.byteLength(body),
-      });
-      res.end(body);
-      return;
-    }
-
     // Build upstream request
     // MCP streamable-http has a single endpoint; forward directly to upstream path.
     // Accio requests http://127.0.0.1:18787/mcp → upstream https://api.holin.work/icbu/mcp
@@ -388,6 +390,14 @@ async function cmdAuthLogin() {
     process.exit(1);
   }
 
+  // Write login lock so the running proxy does not exit during re-auth credential gap.
+  ensureConfigDir();
+  writeFileSync(LOGIN_LOCK_FILE, String(process.pid), "utf-8");
+  const removeLock = () => { try { if (existsSync(LOGIN_LOCK_FILE)) unlinkSync(LOGIN_LOCK_FILE); } catch {} };
+  process.on("exit", removeLock);
+  process.on("SIGINT", () => { removeLock(); process.exit(1); });
+  process.on("SIGTERM", () => { removeLock(); process.exit(1); });
+
   console.log("[holin-cli] Verifying API Key...");
   let result;
   try {
@@ -430,6 +440,7 @@ async function cmdAuthLogin() {
     console.error(`[holin-cli] Warning: Failed to start local proxy — ${err.message}`);
     console.error("[holin-cli] You can start it manually with: holin-cli proxy start");
   }
+  // Lock removed automatically via process.on("exit")
 }
 
 function cmdAuthLogout() {
@@ -528,12 +539,20 @@ function cmdProxyStart() {
       return;
     }
     // Check if credentials file still exists (user may have logged out / uninstalled)
-    // Use a 30s grace period to avoid false positives during re-auth (old creds cleared, new ones not yet written)
+    // Use a 30s grace period to avoid false positives during re-auth (old creds cleared, new ones not yet written).
+    // Skip the grace period countdown entirely while a login.lock file exists — auth login is in progress.
     const credsExist = existsSync(CREDENTIALS_FILE);
     const creds = credsExist ? readCredentials() : null;
     const hasValidKey = !!(creds?.api_key);
     if (!hasValidKey) {
-      if (!credsMissingSince) {
+      const loginInProgress = existsSync(LOGIN_LOCK_FILE);
+      if (loginInProgress) {
+        // auth login is actively running — reset timer, do not start grace period
+        if (credsMissingSince) {
+          log("[proxy] Login lock detected, resetting credentials grace period.");
+          credsMissingSince = null;
+        }
+      } else if (!credsMissingSince) {
         credsMissingSince = Date.now();
         log("[proxy] Credentials missing, starting 30s grace period...");
       } else if (Date.now() - credsMissingSince > 30000) {
@@ -602,26 +621,29 @@ function waitForPort(port, host, timeoutMs) {
 
 function startProxyDaemon() {
   return new Promise((resolve, reject) => {
-    if (isProxyRunning()) {
-      // Proxy process exists per pid file — also verify port is actually listening
-      waitForPort(PROXY_PORT, PROXY_HOST, 3000).then(resolve).catch(resolve); // best-effort
-      return;
-    }
-
-    ensureConfigDir();
-    const logFd = openSync(LOG_FILE, "a");
-
-    const child = spawn(process.execPath, [process.argv[1], "proxy", "start", "--daemon"], {
-      detached: true,
-      stdio: ["ignore", logFd, logFd],
-    });
+    // Always verify the port is actually reachable first, regardless of pid file.
+    // The old proxy may have exited (idle timeout) while the pid file is stale.
+    waitForPort(PROXY_PORT, PROXY_HOST, 500)
+      .then(() => {
+        // Port is already up — existing proxy is healthy, no need to spawn.
+        resolve();
+      })
+      .catch(() => {
+        // Port not reachable — spawn a new proxy daemon regardless of pid file state.
+        ensureConfigDir();
+        const logFd = openSync(LOG_FILE, "a");
+
+        const child = spawn(process.execPath, [process.argv[1], "proxy", "start", "--daemon"], {
+          detached: true,
+          stdio: ["ignore", logFd, logFd],
+        });
 
-    child.unref();
+        child.unref();
 
-    // Wait until the proxy port is actually accepting connections (up to 10s).
-    // This replaces the old pid-file poll which only confirmed the process existed,
-    // not that it was ready to serve — causing ECONNREFUSED races on slow machines.
-    waitForPort(PROXY_PORT, PROXY_HOST, 10000).then(resolve).catch(reject);
+        // Wait until the proxy port is actually accepting connections (up to 10s).
+        // Only resolve after a real HTTP response from /health — never resolve on catch.
+        waitForPort(PROXY_PORT, PROXY_HOST, 10000).then(resolve).catch(reject);
+      });
   });
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holin-work/holin-cli",
-  "version": "1.3.6",
+  "version": "1.3.8",
   "description": "Holin CLI — Accio plugin authorization tool for ICBU batch listing",
   "type": "module",
   "bin": {